dsh-plugin-container 0.4.6 → 0.5.1

package/src/client/push-image.jsx

@@ -0,0 +1,113 @@
+/** Push a local image to a registry, retagging it first when the target differs. */
+import { useEffect, useMemo, useState } from 'react'
+
+import { Button, Modal, fill } from './components.jsx'
+
+const IMAGE_REF = /^[A-Za-z0-9][A-Za-z0-9_.:/@-]*$/u
+const PRESETS = [
+  { label: 'Docker Hub', prefix: 'myname/' },
+  { label: 'GHCR', prefix: 'ghcr.io/myname/' },
+  { label: 'Quay', prefix: 'quay.io/myname/' },
+]
+
+/** `ghcr.io/me/app:1` -> `app:1` */
+function lastSegment(reference) {
+  const withoutDigest = reference.split('@')[0]
+  return withoutDigest.slice(withoutDigest.lastIndexOf('/') + 1)
+}
+
+export default function PushImageDialog({ open, t, provider, image, onClose, onSubmit }) {
+  const [target, setTarget] = useState('')
+  const [error, setError] = useState(null)
+  const [busy, setBusy] = useState(false)
+
+  useEffect(() => {
+    if (!open) return
+    setTarget(image)
+    setError(null)
+    setBusy(false)
+  }, [open, image])
+
+  const trimmed = target.trim()
+  const valid = IMAGE_REF.test(trimmed)
+  const needsNamespace = valid && !trimmed.split('@')[0].includes('/')
+  const retag = valid && trimmed !== image
+  const command = useMemo(() => {
+    const cli = provider === 'apple-container' ? 'container image' : 'docker'
+    const lines = []
+    if (retag) lines.push(`${cli} tag ${image} ${trimmed}`)
+    lines.push(`${cli} push ${valid ? trimmed : '…'}`)
+    return lines.join('\n')
+  }, [image, provider, retag, trimmed, valid])
+
+  const submit = async (event) => {
+    event?.preventDefault()
+    if (!valid) {
+      setError(t('pullInvalid'))
+      return
+    }
+    setBusy(true)
+    setError(null)
+    try {
+      await onSubmit({ kind: 'image', action: 'push', id: image, target: trimmed, name: trimmed })
+      onClose()
+    } catch (submitError) {
+      setError(submitError instanceof Error ? submitError.message : String(submitError))
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Modal
+      open={open}
+      title={t('imgPushTitle')}
+      subtitle={provider === 'apple-container' ? t('providerApple') : t('providerDocker')}
+      onClose={onClose}
+      closeLabel={t('close')}
+      footer={
+        <>
+          <Button size="sm" variant="ghost" onClick={onClose} disabled={busy}>{t('modalCancel')}</Button>
+          <Button size="sm" variant="primary" onClick={submit} disabled={busy || !valid}>
+            {busy ? t('imgPushing') : t('imgPushStart')}
+          </Button>
+        </>
+      }
+    >
+      <form className="dsh-docker-run-form" onSubmit={submit}>
+        <label className="dsh-docker-field">
+          <span>{t('imgPushSource')}</span>
+          <input className="dsh-docker-input dsh-docker-mono" value={image} readOnly />
+        </label>
+        <label className="dsh-docker-field">
+          <span>{t('imgPushTarget')}</span>
+          <input
+            className="dsh-docker-input dsh-docker-mono"
+            value={target}
+            onChange={(event) => setTarget(event.target.value)}
+            spellCheck="false"
+            autoFocus
+          />
+          <span className="dsh-docker-hint">{t('imgPushTargetHint')}</span>
+        </label>
+        <div className="dsh-docker-chip-row">
+          <span className="dsh-docker-hint">{t('imgPushPresets')}</span>
+          {PRESETS.map((preset) => (
+            <Button key={preset.label} size="sm" variant="ghost" onClick={() => setTarget(`${preset.prefix}${lastSegment(image)}`)}>
+              {preset.label}
+            </Button>
+          ))}
+        </div>
+        {needsNamespace && (
+          <div className="dsh-docker-hint dsh-docker-hint-warn">{fill(t('imgPushNeedsNamespace'), { name: lastSegment(trimmed) })}</div>
+        )}
+        {retag && <div className="dsh-docker-hint">{t('imgPushRetag')}</div>}
+        <label className="dsh-docker-field">
+          <span>{t('imgCommandPreview')}</span>
+          <pre className="dsh-docker-preview">{command}</pre>
+        </label>
+        <div className="dsh-docker-hint">{provider === 'apple-container' ? t('imgPushLoginApple') : t('imgPushLoginDocker')}</div>
+        {error !== null && <div className="dsh-docker-form-error">{error}</div>}
+      </form>
+    </Modal>
+  )
+}

package/src/client/styles.js

@@ -220,7 +220,6 @@ const CSS = `
 .dsh-docker-field > span { font-size: 11.5px; color: var(--dsw-alias-label-secondary, #60636c); }
 .dsh-docker-textarea { height: auto; min-height: 72px; padding: 8px 10px; resize: vertical; font-family: var(--dsw-font-markdown-code-font-family, ui-monospace, Menlo, monospace); line-height: 1.5; }
 .dsh-docker-form-error { color: var(--dsw-alias-label-error, #d33c3c); font-size: 12px; }
-.dsh-docker-check { display: flex; align-items: center; gap: 7px; font-size: 12px; color: var(--dsw-alias-label-secondary, #60636c); }
 
 
 .dsh-docker-table-wrap { overflow: auto; border-radius: 0 0 11px 11px; }
@@ -359,6 +358,18 @@ const CSS = `
 @media (prefers-reduced-motion: reduce) {
   .dsh-docker-spinner, .dsh-docker-skel-line, .dsh-docker-toast { animation: none; }
 }
+.dsh-docker-hint { font-size: 12px; line-height: 1.5; color: var(--dsw-alias-label-tertiary, #8a8d96); }
+.dsh-docker-hint-warn { color: var(--dsw-alias-label-warning, #b7791f); }
+.dsh-docker-line-ok { font-size: 12px; color: var(--dsw-alias-label-success, #2f855a); }
+.dsh-docker-line-err { font-size: 12px; color: var(--dsw-alias-label-error, #d33c3c); }
+.dsh-docker-preview { margin: 0; padding: 8px 10px; border-radius: 8px; white-space: pre-wrap; word-break: break-all; font-family: var(--dsw-font-markdown-code-font-family, ui-monospace, Menlo, monospace); font-size: 11.5px; line-height: 1.55; background: var(--dsw-alias-markdown-code-block, #f6f7f9); border: .5px solid var(--dsw-alias-border-l3, rgba(0,0,0,.08)); }
+.dsh-docker-chip-row { display: flex; flex-wrap: wrap; gap: 6px; align-items: center; }
+.dsh-docker-advanced { border-top: .5px solid var(--dsw-alias-border-l3, rgba(0,0,0,.08)); padding-top: 10px; }
+.dsh-docker-advanced > summary { cursor: pointer; font-size: 12px; color: var(--dsw-alias-label-secondary, #60636c); user-select: none; }
+.dsh-docker-advanced[open] > summary { margin-bottom: 10px; }
+.dsh-docker-advanced-body { display: flex; flex-direction: column; gap: 12px; }
+.dsh-docker-check { display: flex; align-items: center; gap: 8px; font-size: 12.5px; }
+
 `
 
 export function injectStyles() {

package/src/client/tabs/images.jsx

@@ -11,17 +11,22 @@ import {
   displayValue,
   shortId,
 } from '../components.jsx'
-import BuildImageDialog from '../build-image.jsx'
 import { useDockerList } from '../hooks.js'
-import { IconAlert, IconBuild, IconDownload, IconImage, IconInfo, IconPlay, IconTrash, IconUpload } from '../icons.jsx'
+import { PLATFORMS } from '../platforms.js'
+import { IconAlert, IconDownload, IconHammer, IconImage, IconInfo, IconPlay, IconTrash, IconUpload } from '../icons.jsx'
 
 const IMAGE_REF = /^[A-Za-z0-9][A-Za-z0-9_.:/@-]*$/u
 
-export default function ImagesTab({ t, api, provider, context, status, refreshToken, features = [], cwd, onAction, onRunContainer, onInspect, onNotify }) {
+/** Accept a pasted `docker pull nginx` as well as a bare image name. */
+function normalizePullInput(value) {
+  return value.trim().replace(/^(?:docker\s+(?:image\s+)?|container\s+image\s+)pull\s+/iu, '').trim()
+}
+
+export default function ImagesTab({ t, api, provider, context, status, refreshToken, features = [], onAction, onRunContainer, onInspect, onNotify, onPullImage, onPushImage, onBuildImage }) {
   const showArchitecture = features.includes('image-architecture')
   const [search, setSearch] = useState('')
   const [pull, setPull] = useState('')
-  const [buildOpen, setBuildOpen] = useState(false)
+  const [pullPlatform, setPullPlatform] = useState('')
   const enabled = status?.daemon?.state === 'running'
   const list = useDockerList(api, provider, 'images', context, { refreshToken, enabled })
   const items = list.data?.items ?? []
@@ -33,13 +38,13 @@ export default function ImagesTab({ t, api, provider, context, status, refreshTo
 
   const submitPull = (event) => {
     event.preventDefault()
-    const reference = pull.trim()
+    const reference = normalizePullInput(pull)
     if (!IMAGE_REF.test(reference)) {
       onNotify('error', t('pullInvalid'))
       return
     }
     setPull('')
-    onAction({ kind: 'image', action: 'pull', id: reference }, { focusConsole: true })
+    onPullImage(reference, pullPlatform === '' ? undefined : pullPlatform)
   }
 
   return (
@@ -54,9 +59,21 @@ export default function ImagesTab({ t, api, provider, context, status, refreshTo
               value={pull}
               onChange={(event) => setPull(event.target.value)}
               placeholder={t('pullPlaceholder')}
-              aria-label={t('pullPlaceholder')}
+              aria-label={t('imgPullHint')}
+              title={t('imgPullHint')}
               spellCheck="false"
             />
+            <select
+              className="dsh-docker-select"
+              style={{ width: 150 }}
+              value={pullPlatform}
+              onChange={(event) => setPullPlatform(event.target.value)}
+              aria-label={t('imgPullPlatform')}
+              title={t('imgPullPlatform')}
+            >
+              <option value="">{t('imgBuildPlatformAuto')}</option>
+              {PLATFORMS.map((name) => <option key={name} value={name}>{name}</option>)}
+            </select>
             <Button size="sm" type="submit" disabled={pull.trim() === ''}><IconDownload size={13} /> {t('pull')}</Button>
           </form>
         </div>
@@ -64,7 +81,7 @@ export default function ImagesTab({ t, api, provider, context, status, refreshTo
           <span className="dsh-docker-muted">{filtered.length} / {items.length}</span>
           {!showArchitecture && <span className="dsh-docker-muted">{t('restartForArchitecture')}</span>}
           {features.includes('image-build') && (
-            <Button size="sm" onClick={() => setBuildOpen(true)}><IconBuild size={13} /> {t('buildImage')}</Button>
+            <Button size="sm" onClick={onBuildImage}><IconHammer size={13} /> {t('imgBuild')}</Button>
           )}
           <Button size="sm" onClick={list.reload} disabled={list.loading}>{t('refresh')}</Button>
         </div>
@@ -112,7 +129,7 @@ export default function ImagesTab({ t, api, provider, context, status, refreshTo
                           </IconButton>
                         )}
                         {features.includes('image-push') && item.name !== '<none>' && (
-                          <IconButton size="sm" label={t('pushImage')} onClick={() => onAction({ kind: 'image', action: 'push', id: item.name }, { focusConsole: true })}>
+                          <IconButton size="sm" label={t('imgPush')} onClick={() => onPushImage(item.name)}>
                             <IconUpload size={14} />
                           </IconButton>
                         )}
@@ -132,17 +149,6 @@ export default function ImagesTab({ t, api, provider, context, status, refreshTo
           </div>
         </section>
       )}
-
-      <BuildImageDialog
-        open={buildOpen}
-        t={t}
-        provider={provider}
-        cwd={cwd}
-        onClose={() => setBuildOpen(false)}
-        onSubmit={async (input) => {
-          await onAction(input, { focusConsole: true })
-        }}
-      />
     </div>
   )
 }

package/src/host/apple.js

@@ -18,6 +18,7 @@ import {
   resolveCwd,
 } from './commands.js'
 import { AppleCli } from './apple-cli.js'
+import { LONG_JOB_MS, buildArgv, buildSpec, platformOf, pushSpec } from './images.js'
 import { JobManager } from './jobs.js'
 import {
   firstLine,
@@ -395,21 +396,20 @@ export class AppleProvider {
     }
     if (kind === 'image') {
       if (action === 'pull') {
-        return this.run({ argv: ['image', 'pull', safeImageRef(payload.id ?? payload.reference)], cwd: payload.cwd, title: payload.title ?? 'container image pull' }, signal)
-      }
-      if (action === 'push') {
-        return this.run({ argv: ['image', 'push', safeImageRef(payload.id ?? payload.reference)], cwd: payload.cwd, title: payload.title ?? 'container image push' }, signal)
+        const platform = platformOf(payload.platform)
+        return this.run({ argv: ['image', 'pull', ...(platform === undefined ? [] : ['--platform', platform]), safeImageRef(payload.id ?? payload.reference)], cwd: payload.cwd, timeoutMs: LONG_JOB_MS, title: payload.title ?? 'container image pull' }, signal)
       }
       if (action === 'build') {
-        const tag = safeImageRef(payload.tag)
-        const contextPath = resolveCwd(payload.contextPath === undefined ? this.home : requireString(payload.contextPath, 'contextPath'), { fallback: this.home, statSync })
-        const dockerfile = payload.dockerfile === undefined || payload.dockerfile === null ? undefined : requireString(payload.dockerfile, 'dockerfile')
-        if (dockerfile !== undefined && (dockerfile.includes('\0') || dockerfile.startsWith('-') || dockerfile.length > 4096)) throw new CommandError('Dockerfile 路径不合法')
-        const argv = ['build', '--progress', 'plain', '-t', tag]
-        if (dockerfile !== undefined && dockerfile !== '') argv.push('-f', dockerfile)
-        if (payload.noCache === true) argv.push('--no-cache')
-        argv.push(contextPath)
-        return this.run({ argv, cwd: contextPath, timeoutMs: payload.timeoutMs ?? 15 * 60_000, title: payload.title ?? `container build ${tag}` }, signal)
+        const spec = buildSpec(payload)
+        return this.run({ argv: buildArgv(spec), cwd: spec.contextDir, timeoutMs: LONG_JOB_MS, title: payload.title ?? `container build ${spec.tag}` }, signal)
+      }
+      if (action === 'push') {
+        const { source, target } = pushSpec(payload)
+        if (target !== source) {
+          const tagged = await this.cli.exec(['image', 'tag', source, target], { signal, cwd: this.home, timeoutMs: 20_000 })
+          if (tagged.exitCode !== 0) throw new CommandError(`${tagged.stderr}${tagged.stdout}`.trim() || `container image tag 退出码 ${String(tagged.exitCode)}`, 'container/exec-failed')
+        }
+        return this.run({ argv: ['image', 'push', target], cwd: payload.cwd, timeoutMs: LONG_JOB_MS, title: payload.title ?? `container image push ${target}` }, signal)
       }
       if (action === 'delete') {
         return this.run({ argv: ['image', 'delete', safeId(payload.id)], confirm: payload.confirm, cwd: payload.cwd, title: payload.title ?? 'container image delete' }, signal)

package/src/host/images.js

@@ -0,0 +1,143 @@
+/**
+ * Shared validation for image push and build, used by the Docker and Apple
+ * providers. Everything here produces argv arrays; nothing touches a shell.
+ */
+import { readdirSync, statSync } from 'node:fs'
+import { basename, isAbsolute, join, resolve, sep } from 'node:path'
+
+import { CommandError } from './commands.js'
+import { requireString } from './util.js'
+
+const IMAGE_REF = /^[A-Za-z0-9][A-Za-z0-9_.:/@-]*$/u
+const PLATFORM = /^[a-z0-9]+\/[a-z0-9]+(?:\/[a-z0-9]+)?$/u
+const BUILD_ARG = /^[A-Za-z_][A-Za-z0-9_]*=[^\r\n]*$/u
+const DOCKERFILE_NAME = /^(?:Dockerfile|Containerfile)(?:\..+)?$|\.(?:Dockerfile|Containerfile)$/u
+
+export const LONG_JOB_MS = 30 * 60_000
+
+/** @param {unknown} value @param {string} field */
+export function imageRef(value, field) {
+  const reference = requireString(value, field, { max: 512 })
+  if (!IMAGE_REF.test(reference)) throw new CommandError(`镜像名不合法: ${reference}`)
+  return reference
+}
+
+/**
+ * Docker rejects uppercase in the repository part; say so before running.
+ * @param {string} reference
+ */
+function assertLowercaseRepository(reference) {
+  const withoutDigest = reference.split('@')[0]
+  const lastSlash = withoutDigest.lastIndexOf('/')
+  const lastColon = withoutDigest.lastIndexOf(':')
+  const repository = lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest
+  if (/[A-Z]/u.test(repository)) throw new CommandError(`镜像名的仓库部分必须是小写: ${repository}`)
+}
+
+/**
+ * Optional `--platform` value shared by pull and build.
+ * @param {unknown} value
+ * @returns {string | undefined}
+ */
+export function platformOf(value) {
+  if (value === undefined || value === null || String(value).trim() === '') return undefined
+  const platform = String(value).trim()
+  if (!PLATFORM.test(platform)) throw new CommandError(`平台格式不合法: ${platform}（示例 linux/arm64）`)
+  return platform
+}
+
+/** @param {Record<string, any>} payload */
+export function pushSpec(payload) {
+  const source = imageRef(payload.id ?? payload.reference, 'id')
+  const target = payload.target === undefined || payload.target === null || String(payload.target).trim() === ''
+    ? source
+    : imageRef(String(payload.target).trim(), 'target')
+  assertLowercaseRepository(target)
+  return { source, target }
+}
+
+/** @param {unknown} value @param {string} field */
+function list(value, field) {
+  if (value === undefined || value === null) return []
+  if (!Array.isArray(value)) throw new CommandError(`${field} 必须是字符串数组`)
+  if (value.length > 64) throw new CommandError(`${field} 数量过多`)
+  return value.map((entry, index) => requireString(entry, `${field}[${String(index)}]`, { max: 1024 }))
+}
+
+/** @param {unknown} value */
+function statOrNull(value) {
+  try {
+    return statSync(value)
+  } catch {
+    return null
+  }
+}
+
+/** @param {Record<string, any>} payload */
+export function buildSpec(payload) {
+  const tag = imageRef(payload.tag, 'tag')
+  assertLowercaseRepository(tag)
+  const rawDir = requireString(payload.contextDir, 'contextDir', { max: 4096 })
+  if (!isAbsolute(rawDir) || rawDir.includes('\0')) throw new CommandError('构建目录必须是绝对路径')
+  // Normalise so `/a/b/` and `/a/b/./` compare equal to the resolved Dockerfile path below.
+  const contextDir = resolve(rawDir)
+  const dirStat = statOrNull(contextDir)
+  if (dirStat === null) throw new CommandError(`构建目录不存在: ${contextDir}`)
+  if (!dirStat.isDirectory()) throw new CommandError(`不是目录: ${contextDir}`)
+
+  let file
+  if (payload.file !== undefined && payload.file !== null && String(payload.file).trim() !== '') {
+    const name = requireString(String(payload.file).trim(), 'file', { max: 1024 })
+    const resolved = resolve(contextDir, name)
+    const prefix = contextDir.endsWith(sep) ? contextDir : `${contextDir}${sep}`
+    if (resolved !== contextDir && !resolved.startsWith(prefix)) throw new CommandError('Dockerfile 必须位于构建目录内')
+    const fileStat = statOrNull(resolved)
+    if (fileStat === null || !fileStat.isFile()) throw new CommandError(`找不到 Dockerfile: ${name}`)
+    file = resolved
+  } else if (statOrNull(join(contextDir, 'Dockerfile')) === null && statOrNull(join(contextDir, 'Containerfile')) === null) {
+    throw new CommandError('构建目录里没有 Dockerfile 或 Containerfile，请选择其他目录或指定文件')
+  }
+
+  const platform = platformOf(payload.platform)
+  const buildArgs = list(payload.buildArgs, 'buildArgs').map((entry) => {
+    if (!BUILD_ARG.test(entry)) throw new CommandError(`构建参数格式不合法: ${entry}（示例 KEY=VALUE）`)
+    return entry
+  })
+  return { tag, contextDir, file, platform, noCache: payload.noCache === true, buildArgs }
+}
+
+/** Both `docker build` and `container build` accept this flag set. */
+export function buildArgv(spec) {
+  return [
+    'build',
+    '-t',
+    spec.tag,
+    ...(spec.file === undefined ? [] : ['-f', spec.file]),
+    ...(spec.platform === undefined ? [] : ['--platform', spec.platform]),
+    ...(spec.noCache ? ['--no-cache'] : []),
+    ...spec.buildArgs.flatMap((entry) => ['--build-arg', entry]),
+    spec.contextDir,
+  ]
+}
+
+/**
+ * Describe a candidate build directory so the form can validate before running.
+ * @param {unknown} value
+ */
+export function inspectBuildContext(value) {
+  const path = typeof value === 'string' ? value.trim() : ''
+  const empty = { path, exists: false, isDirectory: false, dockerfiles: [], suggestedTag: '' }
+  if (path === '' || !isAbsolute(path) || path.includes('\0') || path.length > 4096) return empty
+  const stat = statOrNull(path)
+  if (stat === null) return empty
+  if (!stat.isDirectory()) return { ...empty, exists: true }
+  let names = []
+  try {
+    names = readdirSync(path).filter((name) => DOCKERFILE_NAME.test(name) && statOrNull(join(path, name))?.isFile())
+  } catch {
+    names = []
+  }
+  names.sort((a, b) => Number(b === 'Dockerfile') - Number(a === 'Dockerfile') || a.localeCompare(b))
+  const slug = basename(path).toLowerCase().replace(/[^a-z0-9._-]+/gu, '-').replace(/^[^a-z0-9]+|[^a-z0-9]+$/gu, '')
+  return { path, exists: true, isDirectory: true, dockerfiles: names.slice(0, 20), suggestedTag: slug === '' ? '' : `${slug}:latest` }
+}

package/src/host/service.js

@@ -7,7 +7,7 @@
  * records live in this plugin's memory and disappear on unload.
  */
 import { homedir } from 'node:os'
-import { statSync } from 'node:fs'
+import { readFileSync, statSync } from 'node:fs'
 
 import {
   CommandError,
@@ -23,6 +23,7 @@ import { AppleProvider } from './apple.js'
 import { AttachManager } from './attach.js'
 import { AppleCliError, AppleCommandError } from './apple-cli.js'
 import { DockerCli, DockerCliError, DockerCommandError } from './docker-cli.js'
+import { LONG_JOB_MS, buildArgv, buildSpec, inspectBuildContext, platformOf, pushSpec } from './images.js'
 import { JobManager } from './jobs.js'
 import {
   firstLine,
@@ -41,6 +42,15 @@ import {
 import { createRuntimeResolver } from './runtime.js'
 import { codeOf, isRecord, messageOf, optionalInteger, requireString } from './util.js'
 
+/** Reported by `ping`; read once so it always matches the published package. */
+const PLUGIN_VERSION = (() => {
+  try {
+    return String(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version)
+  } catch {
+    return 'unknown'
+  }
+})()
+
 const STATUS_CACHE_MS = 1500
 const CONTEXT_CACHE_MS = 10_000
 const VALUE_CACHE_MS = 1500
@@ -189,12 +199,14 @@ export class DockerService {
           return ok({
             ok: true,
             plugin: 'dsh-plugin-container',
-            version: '0.2.0',
+            version: PLUGIN_VERSION,
             dockerPath: this.cli.dockerPath ?? null,
             containerPath: this.apple.cli.containerPath ?? null,
           })
         case 'providers':
           return ok(await this.providers(signal))
+        case 'buildContext':
+          return ok(inspectBuildContext(payload.path))
         case 'status':
         case 'list':
         case 'inspect':
@@ -737,22 +749,28 @@ export class DockerService {
       }, signal)
     }
     if (kind === 'image' && action === 'build') {
-      const tag = safeImageRef(payload.tag)
-      const contextPath = resolveCwd(optionalString(payload.contextPath, 'contextPath') ?? this.home, { fallback: this.home, statSync })
-      const dockerfile = optionalString(payload.dockerfile, 'dockerfile')
-      if (dockerfile !== undefined && (dockerfile.includes('\0') || dockerfile.startsWith('-') || dockerfile.length > 4096)) {
-        throw new CommandError('Dockerfile 路径不合法')
+      const spec = buildSpec(payload)
+      return this.run({
+        argv: buildArgv(spec),
+        context: payload.context,
+        cwd: spec.contextDir,
+        timeoutMs: LONG_JOB_MS,
+        title: payload.title ?? `构建镜像 ${spec.tag}`,
+      }, signal)
+    }
+    if (kind === 'image' && action === 'push') {
+      const { source, target } = pushSpec(payload)
+      if (target !== source) {
+        await this.cli.ensureDocker({ signal })
+        const resolved = await this.resolveContext(optionalString(payload.context, 'context'), signal)
+        await this.cli.docker(['tag', source, target], { context: resolved.name, signal, timeoutMs: 20_000 })
       }
-      const argv = ['build', '--progress', 'plain', '-t', tag]
-      if (dockerfile !== undefined && dockerfile !== '') argv.push('-f', dockerfile)
-      if (payload.noCache === true) argv.push('--no-cache')
-      argv.push(contextPath)
       return this.run({
-        argv,
+        argv: ['push', target],
         context: payload.context,
-        cwd: contextPath,
-        timeoutMs: payload.timeoutMs ?? 15 * 60_000,
-        title: payload.title ?? `构建镜像 ${tag}`,
+        cwd: payload.cwd,
+        timeoutMs: LONG_JOB_MS,
+        title: payload.title ?? `推送镜像 ${target}`,
       }, signal)
     }
     const id = safeIdentifier(payload.id ?? payload.reference)
@@ -764,8 +782,17 @@ export class DockerService {
       else if (action === 'delete') argv = ['rm', '-f', id]
       else if (action === 'logs') argv = ['logs', '--tail', payload.follow === true ? '100' : '500', ...(payload.follow === true ? ['-f'] : []), id]
     } else if (kind === 'image') {
-      if (action === 'pull') argv = ['pull', id]
-      else if (action === 'push') argv = ['push', id]
+      if (action === 'pull') {
+        const platform = platformOf(payload.platform)
+        argv = ['pull', ...(platform === undefined ? [] : ['--platform', platform]), id]
+        return this.run({
+          argv,
+          context: payload.context,
+          cwd: payload.cwd,
+          timeoutMs: LONG_JOB_MS,
+          title: payload.title ?? `拉取镜像 ${id}`,
+        }, signal)
+      }
       else if (action === 'delete') argv = ['rmi', id]
     } else if (kind === 'volume' && action === 'delete') {
       argv = ['volume', 'rm', id]